Cheat Engine

[0_00_0]

Alright, i figured i'd go back to the basics of defeating DMA.

Anyways, i'm having problems, even with that.

I'll explain my process, please tell me what i'm doing wrong, i'm trying to find a static pointer to an address.

1. Find the address (0C12DAF8)
2. Find what writes to the address - mov [esi+2dc], eax
esi = C12D81C
3. perform hex search for C12D81C
4. pull the top value off the list (01C67984)(found 5 others)
5. add addres manually (pointer)(address: 1C67984, offset: 2dc)
6. i now have a pointer that points to 0C12DAF8 (yay!)

however, whenever i restart msn, the value of the pointer just becomes ??.

i must be skipping/not doing a step somewhere :\\\ (or just completely not doing it right). Any tips

[Labyrnth]

whats the value or eax ?

Once you find out what writes to the first address, You probably already have what you need to beat the dma.

2. Find what writes to the address - mov [esi+2dc], eax
^ You probably have the static address already by finding this instruction.
meaning you beat the DMA possibly.

[Death4ngel]

Hey That Happened to me too. But I was in a hurry that day and didn't really checked all my stuff. Since my family was rushing me off to visit my relatives on CNY. (Chinese New Year)

[0_00_0]

[Labyrnth]

No the address for that instruction is possibly the static address you need,

What is it your hacking lives?

mov [esi+2dc], eax

eax = 3 lives or what ever it is.
===============================================

This injection will give you 99 lives or what ever. Thus you have beat the DMA. Because the address at: mov [esi+2dc],eax is a static address.

mov eax,63 <---- Passing decimal of 99 to eax "63 in hex = 99 in dec."
mov [esi+2dc],eax <---- Moving eax to [esi+2dc]
===============================================

Im only going with the code and by what info you have given me, to give you a simple example of how your getting past dma.

The first address you find changes every time you restart the game.
Thats a dynamic memory allocated address.
Find what writes to this address.

The find from that will in allot of cases, be a static address where it breaks on the instruction controlling lives, ammo ect...

When you pop there , thats the address you need along with the instruction.
From there you will do a code injection to beat the DMA.

[0_00_0]

Man... I feel like a huge noob, and thats why I hate asking so many questions. I'm just pretty new when it comes to reading memory, etc. I'm a prety proficient programmer, trying to read in some values via ReadProcessMemory(); (C++). Anyways, enough about me.

Let me explain the process I'm taking here. This example will be with WoW, and i will be trying to find the static pointer of health. Pictures will be included! Just to reiterate what i said before, I'm lookin to use this in C++, so i'm looking to find 1 memory address that will point to my health, I don't want to create a program through CE.

1. Look for health(1857) found the mem addy(DMA): 10FAA478
img507.imageshack.us/img507/4292/dmaaddych5.jpg

2. See what writes to that address:
img98.imageshack.us/img98/7931/addywritezx1.jpg

3. Lose/change value of current life
img364.imageshack.us/img364/1836/meminfoza3.jpg

mov[eax + edx*4], ecx

ecx = my health being moved
eax is the mem address <--could use some explanation on this one
edx*4 = offset

ecx = (hex)6e7, (dec)1767
eax = (hex)10FAA420
edx = (hex)16
edx*4 = (hex)58

4. Perform a hex search for EAX(10FAA420)
find 2 addresses
I choose first one(10FA8010)
img100.imageshack.us/img100/6527/hexscanrs4.jpg

5. Add a new memory address manually(pointer)
use 10FA8010 as pointer address
and edx*4((hex)5 as offset
img522.imageshack.us/img522/1258/pointersuccessso0.jpg

6. Now I'm assuming I want to scan for the next pointer up?
Find out what writes to this pointer....

uh oh.. nothing.

7. Log out and in of WoW.. oh no!
img510.imageshack.us/img510/458/restartwowav8.jpg



Here is my dissasembler though, for when i see what writes to my first(DMA) address that i find.

img513.imageshack.us/img513/5315/dissassemblerbh1.jpg



I took a really long time making this post, so I hope you can get a reply to me. Thanks for all the help you've given me so far, and hopefully some more . I've been attempting this for over 2 months now, and I may start to go insane.

P.S. at the end, you say "From there you will do a code injection to beat the DMA.", is that perhaps what I'm missing? Please elaborate

P.S.2 It would've really helped if i could have posted them as pictures and not links w/o the " h t t p : / / "

[Davethewave]

I've had this problem too where the "pointer" isn't static, or I add multiple pointers and they change on next reboot. I don't understand enough of ASM to know what eax, ecx, ebx etc all mean I do understand some meanings but not all. Anyways, what I would suggest is the injected pointer scan, it takes some time but most likely one of the pointers it finds will be a static base pointer and you can use that address in your program.

[Labyrnth]

You need to look if that memory is located in a dll file also when you find it.

And the pointer can appear to be changing because of code shifting.